From d0554fd317c9f8101bca0644519fb8f59f9fc397 Mon Sep 17 00:00:00 2001 From: Ioannis Kakavas Date: Thu, 16 Jan 2020 17:00:17 +0200 Subject: [PATCH] Fail gracefully on invalid token strings (#51014) (#51096) When we receive a request with an Authorization header that contains a Bearer token that is not generated by us or that is malformed in some way, attempting to decode it as one of our own might cause a number of exceptions that are not IOExceptions. This commit ensures that we catch and log these too and call onResponse with `null, so that we can return 401 instead of 500. Resolves: #50497 --- .../org/elasticsearch/xpack/security/authc/TokenService.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java index 50d5a87b9ad..a38f2097705 100644 --- a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java +++ b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java @@ -527,7 +527,7 @@ public final class TokenService { listener.onResponse(null); } } - } catch (IOException e) { + } catch (Exception e) { // could happen with a token that is not ours if (logger.isDebugEnabled()) { logger.debug("built in token service unable to decode token", e);